difference between audit account logon event and audit logon event.

Audit logon events and audit account logon events are two slightly different items that are both quite

valuable in tracking who did what where to whom. As you know, domain-based networks rely on

a small number of computers to validate—log on—users. So a user Ray might try to access a member

server \\SV1, and \\SV1 might try to authenticate that user at a domain controller \\DC2.

Here’s what these two settings would track:

Audit account logon events would tell \\DC2 to log the fact that it was asked to validate Ray◆

and did. That would appear in \\DC2’s log.

Audit logon events would tell \\SV1 to log the fact that it needed to check to see that Ray◆

was a recognized user prior to letting him access something on that machine. The log entry

would appear on \\SV1’s log.

Did you notice the point about where the entries live? That’s important: There is no central domain

repository of logs. Part of your job as an administrator is to collect and manage the logs of all of your

systems. Fortunately, the only logs you typically need are the ones for the domain controllers and

members servers…although workstation logs can be sometimes useful as well